feat: fix random things

.env.example

···
 # Slack API Configuration
 # Get these from https://api.slack.com/apps
-SLACK_TOKEN=xoxb-123456789012-123456789012-abcdefghijklmnopqrstuvwx
+# Either SLACK_BOT_TOKEN or SLACK_TOKEN will work (SLACK_BOT_TOKEN takes precedence)
+SLACK_BOT_TOKEN=xoxb-your-bot-token-here
 SLACK_SIGNING_SECRET=1234567890abcdef1234567890abcdef
+
+# Optional: Slack Rate Limiting
+# Adjust these if you're hitting rate limits or need more throughput
+# SLACK_MAX_CONCURRENT=3    # Max concurrent requests (default: 3)
+# SLACK_MIN_TIME_MS=200     # Min time between requests in ms (default: 200, ~5 req/s)
 
 # Environment
 NODE_ENV=production

src/cache.ts

···
  */
 interface SlackUserProvider {
 	getUserInfo(userId: string): Promise<SlackUser>;
+	testAuth(): Promise<boolean>;
 }
 
 /**
···
 
 interface UserAgentMetrics {
 	userAgent: string;
-	count: number;
+	hits: number;
 }
 
 interface LatencyPercentiles {
···
 				heapUsed: number;
 				heapTotal: number;
 				percentage: number;
+				details?: {
+					heapUsedMiB: number;
+					heapTotalMiB: number;
+					heapPercent: number;
+					rssMiB: number;
+					externalMiB: number;
+					arrayBuffersMiB: number;
+				};
 			};
 		};
 		uptime: number;
 	}> {
-		const checks = {
+		const checks: {
+			database: { status: boolean; latency?: number };
+			slackApi: { status: boolean; error?: string };
+			queueDepth: number;
+			memoryUsage: {
+				heapUsed: number;
+				heapTotal: number;
+				percentage: number;
+				details?: {
+					heapUsedMiB: number;
+					heapTotalMiB: number;
+					heapPercent: number;
+					rssMiB: number;
+					externalMiB: number;
+					arrayBuffersMiB: number;
+				};
+			};
+		} = {
 			database: { status: false, latency: 0 },
 			slackApi: { status: false },
 			queueDepth: this.userUpdateQueue.size,
···
 		// Check Slack API if wrapper is available
 		if (this.slackWrapper) {
 			try {
-				await this.slackWrapper.getUserInfo("U062UG485EE"); // Use a known test user
+				await this.slackWrapper.testAuth();
 				checks.slackApi = { status: true };
 			} catch (error) {
 				checks.slackApi = {
···
 	}
 
 	/**
-	 * Lists all emoji in the cache
-	 * @returns Array of Emoji objects that haven't expired
-	 */
-	async listEmojis(): Promise<Emoji[]> {
-		const results = this.db
-			.query("SELECT * FROM emojis WHERE expiration > ?")
-			.all(Date.now()) as Emoji[];
-
-		return results.map((result) => ({
-			type: "emoji",
-			id: result.id,
-			name: result.name,
-			alias: result.alias || null,
-			imageUrl: result.imageUrl,
-			expiration: new Date(result.expiration),
-		}));
-	}
-
-	/**
 	 * Retrieves a user from the cache
 	 * @param userId Unique identifier of the user
 	 * @returns User object if found and not expired, null otherwise
 	 */
 	async getUser(userId: string): Promise<User | null> {
+		const normalizedId = userId.toUpperCase();
 		const result = this.db
 			.query("SELECT * FROM users WHERE userId = ?")
-			.get(userId.toUpperCase()) as User;
+			.get(normalizedId) as User;
 
 		if (!result) {
 			return null;
···
 
 		// If user is expired, remove and return null
 		if (expiration < now) {
-			this.db.run("DELETE FROM users WHERE userId = ?", [userId]);
+			this.db.run("DELETE FROM users WHERE userId = ?", [normalizedId]);
 			return null;
 		}
 
···
 			const newExpiration = now + 7 * 24 * 60 * 60 * 1000;
 			this.db.run("UPDATE users SET expiration = ? WHERE userId = ?", [
 				newExpiration,
-				userId.toUpperCase(),
+				normalizedId,
 			]);
 
 			// Queue for background update to get fresh data
-			this.queueUserUpdate(userId);
+			this.queueUserUpdate(normalizedId);
 
 			console.log(
-				`Touch-refresh: Extended TTL for user ${userId} and queued for update`,
+				`Touch-refresh: Extended TTL for user ${normalizedId} and queued for update`,
 			);
 		}
 
···
 
 	/**
 	 * Gets user agents data from cumulative stats table
-	 * @param _days Unused - user_agent_stats is cumulative
-	 * @returns User agents data
+	 * @returns User agents data (cumulative, not time-filtered)
 	 */
-	async getUserAgents(
-		_days: number = 7,
-	): Promise<Array<{ userAgent: string; hits: number }>> {
+	async getUserAgents(): Promise<Array<{ userAgent: string; hits: number }>> {
 		const cacheKey = "useragents_all";
 		const cached = this.typedAnalyticsCache.getUserAgentData(cacheKey);
 

src/handlers/index.ts

···
 let cache!: SlackCache;
 let slackApp!: SlackWrapper;
 
+/**
+ * Parse a string to a positive integer, returning a fallback if invalid
+ */
+function parsePositiveInt(value: string | null, fallback: number): number {
+	if (!value) return fallback;
+	const n = Number.parseInt(value, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
 export function injectDependencies(
 	cacheInstance: SlackCache,
 	slackInstance: SlackWrapper,
···
 	request,
 	recordAnalytics,
 ) => {
+	const configuredToken = process.env.BEARER_TOKEN;
+	if (!configuredToken) {
+		console.error("BEARER_TOKEN is not configured");
+		await recordAnalytics(500);
+		return new Response("Server misconfigured", { status: 500 });
+	}
+
 	const authHeader = request.headers.get("authorization") || "";
-	if (authHeader !== `Bearer ${process.env.BEARER_TOKEN}`) {
+	if (authHeader !== `Bearer ${configuredToken}`) {
 		await recordAnalytics(401);
 		return new Response("Unauthorized", { status: 401 });
 	}
···
 	request,
 	recordAnalytics,
 ) => {
+	const configuredToken = process.env.BEARER_TOKEN;
+	if (!configuredToken) {
+		console.error("BEARER_TOKEN is not configured");
+		await recordAnalytics(500);
+		return new Response("Server misconfigured", { status: 500 });
+	}
+
 	const authHeader = request.headers.get("authorization") || "";
-	if (authHeader !== `Bearer ${process.env.BEARER_TOKEN}`) {
+	if (authHeader !== `Bearer ${configuredToken}`) {
 		await recordAnalytics(401);
 		return new Response("Unauthorized", { status: 401 });
 	}
···
 ) => {
 	const url = new URL(request.url);
 	const params = new URLSearchParams(url.search);
-	const daysParam = params.get("days");
-	const days = daysParam ? parseInt(daysParam, 10) : 7;
+	const days = parsePositiveInt(params.get("days"), 7);
 
 	const stats = await cache.getEssentialStats(days);
 	await recordAnalytics(200);
···
 ) => {
 	const url = new URL(request.url);
 	const params = new URLSearchParams(url.search);
-	const daysParam = params.get("days");
-	const days = daysParam ? parseInt(daysParam, 10) : 7;
+	const days = parsePositiveInt(params.get("days"), 7);
 
 	const chartData = await cache.getChartData(days);
 	await recordAnalytics(200);
···
 
 	const startParam = params.get("start");
 	const endParam = params.get("end");
-	const daysParam = params.get("days");
 
 	let options: { days?: number; startTime?: number; endTime?: number } = {};
 
 	if (startParam && endParam) {
-		options.startTime = parseInt(startParam, 10);
-		options.endTime = parseInt(endParam, 10);
+		const start = parsePositiveInt(startParam, 0);
+		const end = parsePositiveInt(endParam, 0);
+		if (start > 0 && end > 0) {
+			options.startTime = start;
+			options.endTime = end;
+		} else {
+			options.days = 7;
+		}
 	} else {
-		options.days = daysParam ? parseInt(daysParam, 10) : 7;
+		options.days = parsePositiveInt(params.get("days"), 7);
 	}
 
 	const traffic = cache.getTraffic(options);
···
 ) => {
 	const url = new URL(request.url);
 	const params = new URLSearchParams(url.search);
-	const daysParam = params.get("days");
-	const days = daysParam ? parseInt(daysParam, 10) : 7;
+	const days = parsePositiveInt(params.get("days"), 7);
 
 	const [essentialStats, chartData, userAgents] = await Promise.all([
 		cache.getEssentialStats(days),
 		cache.getChartData(days),
-		cache.getUserAgents(days),
+		cache.getUserAgents(),
 	]);
 
 	await recordAnalytics(200);

src/lib/analytics-wrapper.ts

···
 					"unknown";
 				const referer = request.headers.get("referer") || undefined;
 
-				// Use the actual request URL for dynamic paths, fallback to provided path
-				const analyticsPath = path.includes(":") ? request.url : path;
+				// Use the pathname for dynamic paths to ensure proper endpoint grouping
+				const requestUrl = new URL(request.url);
+				const analyticsPath = path.includes(":") ? requestUrl.pathname : path;
 
 				await cache.recordRequest(
 					analyticsPath,

src/routes/api-routes.ts

···
 							type: "object",
 							properties: {
 								totalRequests: { type: "number", example: 12345 },
-								averageResponseTime: { type: "number", example: 23.5 },
+								averageResponseTime: {
+									type: "number",
+									nullable: true,
+									example: 23.5,
+								},
 								uptime: { type: "number", example: 99.9 },
-								period: { type: "string", example: "7 days" },
 							},
 						}),
 					]),
···
 					},
 					responses: Object.fromEntries([
 						apiResponse(200, "Chart data retrieved successfully", {
-							type: "array",
-							items: {
-								type: "object",
-								properties: {
-									time: { type: "string", example: "2024-01-01T12:00:00Z" },
-									count: { type: "number", example: 42 },
-									averageResponseTime: { type: "number", example: 25.3 },
+							type: "object",
+							properties: {
+								requestsByDay: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											date: { type: "string", example: "2024-01-01 12:00:00" },
+											count: { type: "number", example: 42 },
+											averageResponseTime: { type: "number", example: 25.3 },
+										},
+									},
+								},
+								latencyOverTime: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											time: { type: "string", example: "2024-01-01 12:00:00" },
+											averageResponseTime: { type: "number", example: 25.3 },
+											p95: { type: "number", nullable: true, example: null },
+											count: { type: "number", example: 42 },
+										},
+									},
 								},
 							},
 						}),
···
 										description: "Unix timestamp of bucket start",
 									},
 									hits: { type: "number", example: 42 },
+									avgLatency: {
+										type: "number",
+										nullable: true,
+										example: 25.3,
+										description: "Average response time in ms",
+									},
 								},
 							},
 						}),

src/slackWrapper.ts

···
 class SlackWrapper {
 	private signingSecret: string;
 	private botToken: string;
-	private limiter = new Bottleneck({
-		maxConcurrent: 10,
-		minTime: 10, // 100 requests per second
-	});
+	private limiter: Bottleneck;
 
 	/**
 	 * Creates a new SlackWrapper instance
···
 	constructor(config?: SlackConfig) {
 		this.signingSecret =
 			config?.signingSecret || process.env.SLACK_SIGNING_SECRET || "";
-		this.botToken = config?.botToken || process.env.SLACK_BOT_TOKEN || "";
+		this.botToken =
+			config?.botToken ||
+			process.env.SLACK_BOT_TOKEN ||
+			process.env.SLACK_TOKEN ||
+			"";
+
+		// Configure rate limiting - defaults are conservative to respect Slack API limits
+		const maxConcurrent = Number(process.env.SLACK_MAX_CONCURRENT ?? 3);
+		const minTime = Number(process.env.SLACK_MIN_TIME_MS ?? 200); // ~5 requests per second
+		this.limiter = new Bottleneck({
+			maxConcurrent: Number.isFinite(maxConcurrent) && maxConcurrent > 0 ? maxConcurrent : 3,
+			minTime: Number.isFinite(minTime) && minTime > 0 ? minTime : 200,
+		});
 
 		const missingFields = [];
 		if (!this.signingSecret) missingFields.push("signing secret");
···
 
 		if (missingFields.length > 0) {
 			throw new Error(
-				`Missing required Slack credentials: ${missingFields.join(" and ")} either pass them to the class or set them as environment variables`,
+				`Missing required Slack credentials: ${missingFields.join(" and ")} either pass them to the class or set them as environment variables (SLACK_BOT_TOKEN or SLACK_TOKEN)`,
 			);
 		}
 	}
···
 	}
 
 	/**
-	 * Verifies a Slack request signature
-	 * @param signature The signature from the request header
-	 * @param timestamp The timestamp from the request header
+	 * Verifies a Slack request signature with timestamp freshness check
+	 * @param signature The signature from the request header (x-slack-signature)
+	 * @param timestamp The timestamp from the request header (x-slack-request-timestamp)
 	 * @param body The raw request body
+	 * @param maxAgeSeconds Maximum age of timestamp in seconds (default: 5 minutes)
 	 * @returns boolean indicating if the signature is valid
 	 */
-	verifySignature(signature: string, timestamp: string, body: string): boolean {
+	verifySignature(
+		signature: string,
+		timestamp: string,
+		body: string,
+		maxAgeSeconds: number = 300,
+	): boolean {
+		if (!signature || !timestamp) {
+			return false;
+		}
+
+		// Reject old timestamps to prevent replay attacks
+		const ts = Number(timestamp);
+		if (!Number.isFinite(ts)) {
+			return false;
+		}
+
+		const now = Math.floor(Date.now() / 1000);
+		if (Math.abs(now - ts) > maxAgeSeconds) {
+			return false;
+		}
+
 		const baseString = `v0:${timestamp}:${body}`;
 		const hmac = createHmac("sha256", this.signingSecret);
-		const computedSignature = `v0=${hmac.update(baseString).digest("hex")}`;
+		const expected = `v0=${hmac.update(baseString).digest("hex")}`;
+
+		// Ensure equal length before timingSafeEqual to avoid exception
+		if (expected.length !== signature.length) {
+			return false;
+		}
+
 		return timingSafeEqual(
-			new Uint8Array(Buffer.from(signature)),
-			new Uint8Array(Buffer.from(computedSignature)),
+			Buffer.from(signature, "utf8"),
+			Buffer.from(expected, "utf8"),
 		);
 	}
 }